escapeboy/agent-fleet-o

What's changed

• chore(phpstan): regenerate baseline on CI runner (PHP 8.4.21) (a72e4a18)
• style: fix pre-existing Pint violations blocking CI (b469e654)
• chore(release): 1.27.0 — UI-gap backlog + docs (0f7d5b9e)
• feat(mcp): 13 read/write tools for the new UI features + safe team resolution (d0b32b72)
• feat(outbound+broadcast): chunk broadcast sends; complete 3 outbound channels (fc5d7590)
• fix(security): explicitly team-scope project dependency dropdown + lookup (275e6381)
• feat(ui): Wave-3 partials — editable agent heartbeat + dry-run, EditProjectForm deps repeater, human-task SLA escalation config (131e947d)
• feat(ui): Wave 3 — reasoning bank, error-mode catalog, test suites, KG communities, crew chat room (e538fc35)
• fix(security): close cross-tenant gaps in secret-scan MCP tool + checkpoints page (48f0e1a9)
• feat(ui): Wave 2 — blacklist, outbound proposals (RO), skill ops, workflow compensation+simulation, experiment checkpoints, memory proposals queue, credential secret-scan findings (1ee81bec)
• feat(outbound): register 5 chat channels as core drivers + config UI (3354c45a)
• feat(ui): Wave 1 batch 1 — AgentSession viewer, release signing-key mgmt, drift + eval-monitor dashboards, broadcast list/create, CSV import wizard (afe0ce88)
• chore: correct domain/MCP/migration counts in CLAUDE.md (08d702b0)
• feat(crew): QA validation surfaces an honest 'could not verify' coverage gap (4f3adc2c)
• feat: searchable model picker component + team-settings refreshManagedModels (ca9a0119)
• fix: make dynamicCatalogModels/resolveCatalogApiKey protected for cloud override (0c92c7b8)
• fix: annotate credentials cast in resolveCatalogApiKey for larastan (bc9a845f)
• feat: dynamic model catalog sync for managed providers (OpenRouter) (d9122dd8)
• feat(evaluation): Agentic AI Flywheel — self-growing eval set, error-mode catalog, drift + production monitors (5c52a116)
• fix(chatbot): remove unreachable default match arm (PHPStan match.alwaysTrue) (3f9e6997)
• style: fix pre-existing Pint violations blocking CI (34ac72fc)
• fix(chatbot): least-privilege access levels for SupportAssistant/Custom (b28aee12)
• test: pin bash_sandbox_mode in GracefulToolDegradationTest (hermetic) (6bfd2f11)
• fix(phpstan): charter property — @property tag + resolve AgentResource access via ->resource (cd0f3bdf)
• feat: Squad + Web IQ borrows — tool-call governance, decision log, evidence citations, agent charter (28594946)
• fix: pipeline-hardening — graceful tool degradation + memory query/embedding fixes (361b58f3)
• feat(agent-chat): A2A consumer-side agent-card discovery (flag-gated, discovery-only) (2afd53e0)
• fix(phpstan): drop stale isLocalProvider unused-method baseline entry (70e71c9b)
• refactor(ai): route all embedding generation through the embedding seam (a20885f2)
• feat(ai): pluggable embedding seam + SemanticCache model namespacing (097c75f8)
• fix(ai): resolve provider/model mismatch at resolution time + cap memory embedding input (f4fe559a)
• feat(widget): thumbs up/down feedback on assistant messages (ea7381d3)
• fix(phpstan): type policy/arbiter code; baseline 2 larastan enum/date quirks (12d58fcd)
• fix(chatbot): strip tool-call narration, enforce user language, enrich citations for all types (3e702a53)
• fix(governance): tenant-scope AgentPolicyGetTool version query + Gate::authorize on policy Livewire writes (97900fc6)
• fix(security): explicit tenant scoping on AgentPolicy Livewire pages (8a9b1c7e)
• feat(crew,ui): competitive arbitration + AgentPolicy Livewire UI + proposal explain panel (a21298e4)
• feat(approval): versioned policy-governed autonomy (AgentPolicy + replay) (60980091)
• fix(mcp): CrewCostEstimateTool — plain Team::find + reword comment for tenant-scope guard (75716beb)
• feat(orchestration): cost-aware orchestration — fan-out cost gate + tier selector (308d83bc)
• fix(mcp): add #[IsDestructive] annotation to MetricTagValueTool (4b90dfc3)
• feat(metrics): Return on Cognitive Spend (ROCS) — cost↔value ROI (d85d5ed2)
• chore(phpstan): baseline taste-sprint false-positives (8.4) (8fcd67ea)
• chore(phpstan): bump CreateAgentTool Request::get baseline count 6->7 (pre-existing drift from taste sprint) (d208abe9)
• feat(phoenix): per-team project routing + auto-ingest local-agent transcripts (f7f2e1bb)
• fix(marketplace): carry taste through publish/install round-trip (3c120260)
• fix(agent): complete taste parity — assistant get + workspace round-trip (0b378e2d)
• feat(agent,budget,memory): borrowed-ideas sprint (contextrie + mercury) (89a7d447)
• fix(test): force local media disk in bug-report widget + signal tests (52238c53)
• fix(test): stub resolveInternal in clarification + plan-with-knowledge tests (bf981cee)
• chore(ci): regenerate PHPStan baseline on runner (clears pre-existing drift) (1c00c608)
• fix(ai): resolve Team explicitly for resolveInternal to satisfy PHPStan (ec82144a)
• style: fix pre-existing Pint drift on 8 files (CI Code Quality gate) (e0668fae)
• fix(ai): BYOK-aware provider resolution for internal pipeline LLM calls (f29892e5)
• feat(widget): public streaming media route for bug-report attachments (f032b0ad)
• fix(sentry): drop partner-webhook retry noise (issue #811) (b3866969)
• fix(storage): address code-review findings (base) (b0b6bf53)
• docs(readme): add architecture flowchart (2b1b6feb)
• feat(storage): migrate upload call sites to TenantStorageManager (stage 3+5) (34c5e2bb)
• feat(storage): S3 tenant disks + TenantStorageManager gateway (stage 1-2) (914a07fb)
• fix(observability): pt3 hotfix — extract before_send closure to static class (31ed1d63)
• fix(observability): pt3 — move pattern filters to Sentry before_send hook (e79710d6)
• fix(phpstan): drop 24 stale baseline entries on ResolveAgentToolsAction (800ed917)
• fix(observability): pt2 — log perms, watchdog queue/timeout, more Sentry filters (5403eefa)
• fix(observability): suppress Sentry noise + recover from auth/no-provider errors (5ab32bbb)
• fix(phpstan): @property hints on enum-cast models + targeted bug fixes (8451a75d)
• fix: audit_entries team_id + Livewire authorize gates (2feca8de)
• feat(agentforce-borrowed): safety middleware, MCP registry, agent workspace (e2a6765c)
• fix(billing): walk back by duration_ms when aggregating execution tokens (bdddaa0d)
• feat(billing): expose cost_credits + real tokens in OpenAI usage block (e85a3e32)
• fix(agent): drop trailing tool mention for tool-less agents (29e46b99)
• fix(agent): honor partner system message and stop hallucinating tool calls (f3a00032)
• fix(security): cap transcript span amplification + authorize attribution ids (00427d05)
• feat(observability): ingest local-agent transcripts into Phoenix traces (246fca16)
• fix(ai): count sub-program key in availableProviders gate (f4b8a001)
• fix(ai): scope agent execution to the token/agent team, not the UI team (cf89fb5c)
• fix(ai): count sub-program key in providerHasApiKey gate (a325cbb6)
• fix(skill): scope lift-eval dataset lookup to team (cross-tenant IDOR) (4bc2670e)
• feat(skill): blind A/B skill-lift eval + failure-mode lint + public quality leaderboard (2a095321)
• fix(quality): resolve phpstan findings introduced by refactor extractions (e19fee62)
• refactor(skill): extract ExecuteSkillAction::execute pipeline phases (9d886561)
• refactor(assistant): break up SendAssistantMessageAction Brain Method (58eace37)
• refactor(tool): extract ResolveAgentToolsAction::execute pipeline phases (dff9df47)
• refactor(tool): extract browser_task closure in ToolTranslator::buildBrowserTools (259ff82e)
• refactor(workflow): extract resolveNode Brain Method into per-type handlers (883e6969)
• fix(code-index): path-traversal guard in PolyglotCodeExtractor materialize (ee2730cd)
• feat(code-index): polyglot extraction via CodeGraph + code_impact tool (cee45cc4)
• fix(ci): repair pre-existing Multica test failures + secret-proxy phpstan (b2a9e39a)
• test: make RunSecretVault tamper assertion deterministic (39dadeee)
• feat(ai): proxy-based secret injection for claude-code-vps (596c7909)
• feat(local-agents): catalog parity with Multica runtime set (375a3874)
• feat(skill): SkillKit hardening — recommended sections + GitHub import (d9926ce7)
• chore(phpstan): clean larastan findings for agentskills/nudge (4faf3b02)
• feat(skill): agentskills.io import/export + memory nudge (dc9f03b6)
• fix(phpstan): clear this session's larastan regressions (4f0f4988)
• fix(mcp): annotate InspectDiffCommentsTool team-self-lookup (CI gate) (139bf8da)
• feat(local-agents): runtime-extensible CLI registry (Multica borrow B) (85b8bece)
• fix(marketplace): symmetric agent publish/install round-trip (34549d85)
• feat(agent): full agent definition round-trip in workspace export/import (e90bd42a)
• test(mcp): pin MCP Apps capability gate to SEP-1865 (2026-01-26) (8e5741ae)
• feat(guardrail): code comment guardrail (oh-my-opencode borrow) (31b2ba80)
• feat(guardrails): agent action guardrails — SQL gating, N-of-M approvals, LLM approval summaries (247f3a91)
• feat(db): add pgvector columns to existing tables (idempotent, guarded) (f3086cef)
• feat(signal): fix-durability loop — detect & learn from fixes that don't survive (dd87a42f)
• fix(signal): annotate Signal metadata + learned_relevance properties for PHPStan (4e92ec51)
• feat(signal): borrow CondenseIt — HN/Reddit/GitHub-Releases connectors, novelty enrichment, learned relevance ranker (81653b6d)
• feat(governance): dotCMS-borrowed brand voice, content quality gate, MCP schema introspection (7511d7fe)
• chore: align main to develop tree, preserve local-mode CSP fix (138b2809)
• chore(phpstan): regenerate base baseline in CI runner env (0f2413db)
• feat(api): support tool_ids on agent update endpoint (f0060599)
• fix(sentry-watchdog): dispatch one job per (team, project) (3c8ddfeb)
• fix(sentry-watchdog): scope triage to the integration's Sentry project (ff35dccc)
• fix(sentry-watchdog): unblock autonomous PR delegation (07bdf019)
• fix(phpstan): @property annotations for SkillVersion, ExperimentStage, Integration (#92) (bc34d1d5)
• fix(docker): remove hardcoded plugin paths, move to override.yml.example (#91) (1da47dcd)
• fix(integration): Sprint B — 3 medium driver fixes (Sentry, Attio, LinkedIn) (c0965576)
• fix(integration): hotfix 10 driver issues found in agent-team validation (fd1011c5)
• fix(phpstan): batch 5 — Chatbot/Signal sub/KG/Telegram + Livewire callers (issue #82 final stretch) (#90) (f1e116ae)
• fix(phpstan): batch 4 — Approval/Signal/Outbound/Audit/Bridge @property (#89) (12e1794a)
• fix(phpstan): batch 3 — Team/Experiment/PlaybookStep/Assistant @property completion (#88) (b3ac2267)
• fix(phpstan): batch 2 — Agent + Marketplace + Trigger @property gaps, Resource @mixins (#87) (890c5048)
• fix(phpstan): batch 1 — JSONB @property annotations across Tool/Marketplace/Skill/Crew/Workflow/Project/Email domains (#86) (cfa1d7b1)
• fix(csp): allow Vite HMR + dev WebSocket origins in local mode (#84) (562cfcbf)
• fix(phpstan): unblock CI — add @property annotations for JSONB models (#85) (e35f092a)
• feat(sentry-watchdog): Phase 1 infrastructure — auto-fix workflow + submodule routing + PR email (18e7ccfb)
• fix(sentry-watchdog): suppress Cron noise + forensic logging on triage defaults (c4fece9f)
• fix(sentry-watchdog): batch criticals into one digest + add admin UI (2ba80b85)
• feat(theneo-borrowed): llms.txt routes + skill breaking-change detector + x-ask-ai component (4edb401c)
• fix(security): tenant-isolation sweep — 3 architecture tests + 4 MCP bug fixes (b29a3bc8)
• fix: resolve Resend-merge PHPStan debt — model docblocks, dead code, MCP annotations (a812ea3b)
• fix(security): gate every Livewire write method + close test coverage gap (7e71164c)
• fix: gate the Audit Log page to admin/owner roles (ac38a1de)
• fix: theme + tenant-scope two cloud admin pages (28b30def)
• fix: redirect unauthenticated Pulse visitors to login (452e3f57)
• fix: add Pulse migration — Pulse publishes it, does not auto-load (1cac2928)
• feat: add viewPulse gate for Laravel Pulse access (3ed81634)
• feat: Broadcast domain, Audiences UI, Resend provider settings (8cd49502)
• feat: Resend email integration — connector, delivery webhooks, audiences (490213a2)
• feat(mcp): add mcp:call debug command + Bridge computer-use guide (fea9c2cb)
• feat(code-index): complete the deferred code-element embedding phase (1601374f)
• feat(memory): RoBrain-borrowed belief fields — rejected alternatives, supersession, contradiction scan (124cfd21)
• feat(memory): add Tenure-inspired structured belief fields (d0826283)
• fix: satisfy PHPStan in DecisionRubric (817c6ff0)
• feat: CraftBot-borrowed sprint — decision rubric, event distillation, format guide (0cf48a4d)
• fix(landing): correct MCP tool count in FAQ (e976e4e8)

Upgrade

git fetch --tags origin
git checkout tags/v1.27.0
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan optimize

Docker users: Pull the latest image and restart your containers.